Drawing upon decades of experience, RAND provides research services, systematic analysis, and innovative thinking to a global clientele that includes government agencies, foundations, and private-sector firms.

The Pardee RAND Graduate School (PRGS.edu) is the largest public policy Ph.D. program in the nation and the only program based at an independent public policy research organization—the RAND Corporation.

Systems Analysis Versus Systems Design

SA not the same as model building, includes
more difficult framing of questions relevant to AF decisions,
devising systems and relating results to policy.

SA difficulties are AF's difficulties. Mutual
benefit from recognizing this. A good SA starts and ends with
AF objectives, but may refine these in process.

An Air Force Example: Genesis of the Intercontinental
Mission.

B-36 decisions illustrate choice among multiplicity
of uncertain alternatives at least as great as C. J. Hitch showed
for SA. AF objectives stated in their connection were multiple,
rapidly changing, partially overlapping and partially in conflict. Some in
the nature of hedges or contingency plans.

Performance in likely and less likely events.
Desperate measures for desperate circumstances.

Can we invent a dominant system, "best
possible?"

Like "worst possible," "best
possible" hard to define. In any case hardly to the point.

Changes in modern weapon technology swift and
continual. Implications complex and far reaching. Not unlikely
therefore that actual programs will lag. Opportunities for an
inventive systems analyst. Our inertia.

SA helpful if it can find and prove system
better than others, which might otherwise be accepted. This it
has done.

THE ECONOMIC ANALYSIS OF DEFENSE PROBLEMS
-- CHOICE WITHOUT MARKETS[1]

Albert Wohlstetter

The subject assigned in this lecture--the design
and formulation of systems studies--is among the most important
and at the same time among the most difficult to say anything
very formal, precise, and positive about. It is easy to say a
lot of negative things on the subject. But it must be clear at
the outset that no rules will guarantee a fruitful system design.
For systems analysis is not the same thing as model construction
or game building. I would like to say a bit about the distinction
between them.

I. Systems Analysis vs. Models, and the Problems
Motivating Analysis.

A systems analysis is an attempt to discern and answer
questions of importance in the choice of policy, and a mathematical
model, as Mr. Specht has made clear in an earlier lecture, is
frequently a most useful device in obtaining answers to these
questions. Sometimes two or three mathematical models are even
more helpful. However, as he suggested, the construction and
manipulation of such models is by no means the whole of the job.
In fact, asking fruitful questions, ingeniously designing alternative
systems to be compared, and skillfully interpreting the results
of the calculations performed in the comparison, relating them
to the problems that motivated the inquiry, are much more critical
phases than the manipulation itself. Analysts are sometimes prone
to forget this because most of their time is spent in the manipulation,
and because the manipulatory techniques are most easily explained
and transferred--cook-book fashion.

But a careful study of the Palmer method of penmanship
is no foolproof formula for writing a good novel. Though a clear
hand, speed in at least one-finger typing, knowledge of grammar,
and ability to spell all help. For a systems analysis skill in
quantitative model building is useful and, where the problem is
complex, even essential (unlike the case of penmanship and the
novel). But it is not enough. systems analysis would be much
easier if it were merely model construction.

I think that Mr. Hitch's introductory lecture made
clear that systems analyses are anything but easy. You will recall
that he illustrated how the intrepid analyst, interested in comparing
alternative systems for development, might be attempting to pick
one out of a million or more alternatives. I would like to stress
in this connection that the difficulties that Mr. Hitch recounted
arise largely because of the necessity to relate the results of
calculation to the Air Force problems which motivate the inquiry.
They are in fact the Air Force's difficulties. The four-to-the-tenth-power
alternatives that explicitly beset the analyst are present in
equal multiplicity, if not in equal explicitness, whenever the
Air Force makes a decision to develop a specific type of bomber
or missile. The analyst's problem is the same, in this respect,
as that of the decision-maker.

By pointing to the complexity of the decision-maker's
problem, I do not mean to suggest that sensible decisions are
impossible without systems analysis. It's quite clear, in fact,
that several have been made. Some of the million alternatives
can, with impunity, be dismissed by a sensible fellow, whether
an analyst or a decision-maker. On the other hand, it is also
clear that in the past some very important alternatives have been
ignored. And while systems analysis is no guarantee that we will
consider all the relevant important alternatives (it should be
clear that systems analysis is not a substitute for sense), it
does force much greater explicitness and it does make the alternatives
examined--and the omissions--a little more open to scrutiny.

The complaints not infrequently heard about the Assumptions
Made in Systems Analyses do not, I think, mean that by comparison
staff studies and staff decisions are innocent of arbitrary or
unrealistic assumptions. Much less that, as I heard suggested
once, they are innocent of assumption altogether. The comparative
frequency of such complaints, which are sad to say sometimes quite
well founded, are a tribute to the relative explicitness of the
assumptions and reasoning in a systems analysis. Systems analysis
can assist decision.

The above also suggests that a systems analysis is
likely to be most helpful if the analyst has taken care to examine
closely the character and source of the problem confronting the
decision-maker, the objectives he wants to achieve, the obstacles
he must surmount to achieve them, and what achieving them does
for him.

II. An Air Force Example: Genesis of the Intercontinental
Mission

Let me illustrate these points--the complexity of
the decision-maker's problem, its identity with the problem tackled
by the analyst, and the usefulness to the analyst of examining
the way the decision-maker's problem arises--by recalling the
history of the B-36 and the genesis of the Air Force requirement
for an intercontinental bombing capability. This story will throw
a little light on "Missiles Systems for the Future"
(MSF), the hypothetical systems analysis which Mr. Quade presented
for course study.

The B-36 was conceived in April, 1941, after the
fall of France, and a succession of defeats which isolated the
United Kingdom and consolidated the German position in Western
Europe. It was thought of as a hedge against the possible loss
of England, an insurance that in the event of this loss, we would
be able to fly over the bodies of our fallen friends to administer
some damage to Germany. Major Vandenberg and a small study group
in the Air Plans Section called for a bomber of 10,000 statute
mile range, capable of delivering 10,000 pounds of high explosive.
By the fall of that year after a design contest, two prototypes
were ordered.

But while the prototypes were being readied, the
situation changed drastically. The prototypes had not been delivered
by the summer of 1943, and by then it was clear that the United
Kingdom was not going to be lost. We were, however, now at war
with Japan. Though we had won Guadalcanal, the outcome of the
stepping stones campaign was uncertain. The B-36 was then conceived
as a hedge against failure here. To shorten the slow development
- procurement - operation cycle, we ordered 100 B-36's in advance
of the delivery of the prototypes. Some place along in this process
also there was trouble with the B-29. And the B-36 then assumed
the role of insurance against trouble here.

But the stepping stones campaign succeeded, and the
B-29's began to look very good. And, since there was an aluminum
shortage, the B-36 program was stretched out. After VE day it
was clear the B-36 was not going to play a role in World War II.
The Air Force, however, was clear about the fact that World War
III had to be considered, and there was a serious problem as to
the base-target radii which might be forced on us. What bases
could we obtain for use in the next war, and how long would it
take us to get them in time of peace or war? As we know, now
that we have secured military rights in a great many countries,
such negotiations are long drawn out and uncertain. General Vandenberg
recommended buying the B-36 to hedge against the uncertainties
of peace-time negotiation and as an alternative to seizure after
the outbreak of war.

This brings us to the post-war period. Up to this
time the B-36 had been conceived entirely in terms of the delivery
of high explosives, with all of the limitations this imposes on
effectiveness at extended distances. Hiroshima changed the aspect
of strategic bombing in general and improved in particular the
prospects of intercontinental delivery, which up to then could
have had only a marginal value even as a measure of desperation.
Now it appeared that if we could get the B-36 into production,
we might have a real hedge for assuring a devastating bombing
of Russia in case this became necessary. And the succession of
war scares beginning with the Berlin airlift, and before we had
developed an extensive overseas base system, suggested that it
might indeed be necessary.

The role of strategic bombing at this time was conceived
rather differently from the way we look at it today. We had,
and assumed we would continue to have, only a very limited supply
of A-bombs. We assumed the enemy had none, and could wage only
a high-explosive campaign against the U.S. and against our bases.
The B-36 atomic attack against the enemy's vital industrial and
administrative centers appeared then not merely as a retaliation
and a deterrent, but, by interrupting the slow process of attrition
which was all the enemy could hope for in a high-explosive campaign,
it appeared it would serve also as a war-time defense of our own
military potential.

But meanwhile more troubles beset the B-36. There
were performance problems, for example, in achieving military
missions with the range originally called for. And there were
a variety of modifications of the plane incorporating some of
the advances in the state of the art not originally anticipated.
By the end of 1947 other instruments for accomplishing very long-range
missions were being given favorable consideration. In particular
air-refueling was recommended by the heavy bombardment committee
as permitting bombers with better speeds and other desirable performance
characteristics, as distinct from combat radius, while preserving
extended radius for the system (tanker plus bomber) as a whole.
And the need for high performance in the penetration segment
of the mission was emphasized by the perfection of jet fighters.

About this time the well known inter-service disagreements
on the subject occurred, and there were also a good many differences
of opinion in the Air Force. In these disagreements the relative
importance of range, altitude, speed, and weight were much agitated.
Within the Air Force there were advocates of the B-29 as well
as advocates of the B-36. The former stressed the B-29's speed
superiority, the latter emphasized the B-36's longer legs. But
throughout the discussion one thing was evident. Speed and range
were both desirable performance characteristics, as were also
altitude, military load, and a good many others. But, in general,
if you got a maximum of one in any given state of the arts, you
sacrificed one or several of the other performance features of
the plane. Unfortunately, it isn't possible to get the best of
everything. You have to trade something of one for something
of another. But at what rate should we trade? How do speed and
altitude affect our anticipated attrition in the air? How does
range affect our attrition on the ground, and our dependency on
our allies? If in the long history of the B-36 no very clear-cut
answers to these questions were made, this is hardly a derogation
of the disputants. This systems analysis course, I'm afraid,
will make evident there are at least a few aspects of these questions
that are not exactly settled now. In fact, it is not easy to
describe exactly how you go about answering these questions.

The Morals

One question I do not intend to raise is whether
the Air Force was always right or sometimes wrong in the extended
sequence of decisions it had to make in the press of this fascinating
history. Such a question I feel is supremely unimportant. It
is of course much easier to be wise at this stage. (Many of the
decisions, I think, were correct in context even if improvable
with hindsight. And while others were questionable, this is hardly
interesting.)

There are, however, several morals. The first is
that the Air Force decision-maker's lot is not an easy one. The
history of the B-36 development, procurement, and operation illustrates
vividly the process of selection among a huge multiplicity of
uncertain alternatives. Bases, targets, range, speed, altitude,
bombs, enemy defense and offense all assumed in prospect and in
actuality at least as many values as Mr. Hitch demonstrated were
present in a systems analysis. And these were not trivial variations.
Just think of the change of our bomb load from iron bombs to
the Hiroshima A-bomb and then to the multi-megaton H-bomb. And
the change in the enemy's defenses from props to jets.

Second, the objective of an Air Force decision may
itself be far from simple. In the case of the B-36, the Air Force
had not one but many objectives and these were altered radically
by swift changes in the strategic and technical situation.

The third point also concerns objectives. It appears
that the differing vehicle types in "Missiles Systems for
the Future," like the B-29 and the B-36, might serve partially
different (as well as partially identical) objectives. But how
then do we compare them?

The fourth point this history illustrates is that
while choice among nice things is difficult, it is also necessary.
Objectives conflict. It is not possible to move ahead simultaneously
in range, speed, altitude, and everything else. But how do we
choose a particular combination when we make up, say, a general
operating requirement for SAC? And how do we design our systems
studies so as to answer rather than beg such questions?

The fifth point the story illuminates is the function
of hedging or insurance objectives and the role of intercontinental
bombing. The B-36 was conceived as a hedge and the problem of
hedging against analogous uncertainties is always with us. Such
a problem should generate plans for contingencies which might
not eventuate, in fact may be unlikely. As I have mentioned,
"Missiles Systems for the Future" hardly faced this
problem in its comparison of intercontinental and overseas missiles,
but neither do most staff studies or systems analyses. How do
we design such studies? And how can we best design a force that
includes an insurance capability?

I have stressed that systems analysis is no more
difficult than Air Force decisions. In a sense, they are no less
difficult either. They should start and end with the Air Force
objectives and the obstacles to obtaining them. But in the process
of analysis these objectives may be refined and altered. I would
like to examine the way in which objectives enter into the process
of Air Force development.

III. Objectives and Constraints in the Design
of Systems Studies

One man's means is another man's objective

This brings us to the subject of Air Force objectives.
The Air Force gets out in the course of its development planning
various documents called GOR's: general operating requirements
for an interceptor, say, or for a bomber. A GOR for a chemically
fueled bomber might state as an objective that the plane be able
to travel 4,500 nautical miles and return without refueling, that
it be able to go Mach 2.5 for 1,200 of these 4,500 miles, that
it be able to carry bombs of a certain size and weight and deliver
them with a given accuracy, say 1,500 feet, and that the altitude
of penetration and bombing be greater than a certain minimum.
Another GOR, for a nuclear-powered bomber, might state in addition
to a certain combination of the familiar performance parameters,
that the radiation dose absorbed by the crew must be no greater
than .2 roentgens per hour. And similarly in the field of base
installations the Air Force sets certain goals. For example,
it has in the past asked contractors planning air bases in the
ZI to concentrate the elements on the base so as to reduce utilities
such as roads, plumbing, etc. to a minimum within the limits set
by the normal fire safety clearances.

So far as the contractor is concerned, these goals
are taken as constraints within which he does his work of design.
This is necessary in order for him to get on with his work.
The aircraft designer then considers in the light of his knowledge
of the state of the arts, such questions as the best system for
controlling armament on a platform moving in the way required
of the given aircraft, the optimal configuration for the wing
and fuselage in order to house the required military load at minimum
weight or cost. If the contract concerns bases, the contractor
will consider the best configuration of runways, parking areas,
housing, etc., given a certain site in order to keep costs to
a minimum for the desired operation. If we designate the objectives
which the Air Force specifies Oi, and the means which the
contractor uses to obtain these objectives Ni, we might describe
this situation as follows:

(1) Mi  Oi

Now within the contractor's organization, in perfecting the detailed design
of Mi, it will be useful for Mi itself to appear in
the form of a constraint
or objective toward which some smaller section of his organization is
working, a lower-order objective clearly than Oi. We might write
it Oi-1.
And revrite formula (1) as

(2) Oi-1  Oi

And just as little fleas have smaller fleas to bite 'em, and so on ad
infinitum, this process of division of labor might be continued with
profit. So that we could write formula (3) as follows:

(3) . . .  Oi-2  Oi-1
 Oi

For example, to achieve one component objective in
the development of an interceptor, there might be a very large
group working on the fire control system, and this group might
have separate teams working on the airborne radar system, the
analogue computer, and the armament systems, which are components
of the fire control system. The team might take as an objective
the design of the airborne radar with, among other things, a scan
angle of 70 degrees each side of dead ahead, and work within this
constraint. (See Figure 1A.) But the point to recognize is that
just as we have extended our horizon to the left of Oi, analyzing the
way means to the Air Force objective might appear in the form of
narrower goals, we might also extend it to the right and on occasion
must, looking to see what further ends are served by the Air Force
requirement.

(4) . . .  Oi-2  Oi-1
 Oi  Oi+1
 Oi+2
 . . .

Or take our example of the fire control system for
the interceptor. We might have a sequence of increasingly comprehensive
systems: airborne radar, fire control system, interceptor, interceptor
wing plus ground radar, a defended offensive wing consisting of
an interceptor wing plus a ground radar plus a bomber wing, and
so on. Figures 1A and 1B taken together illustrate this hierarchy
of systems. While the narrowest systems can be treated, and,
in fact, most frequently must be treated, in comparative isolation,
this isolation is only comparative and never final. it is always
possible that there is some important interaction affecting design
on other levels. For example, it might be that it is difficult
to design the radar to have a scan angle of ±70 degrees as
specified, but by designing the interceptor to have atighter
turning radius this angle could be narrowed. Or one might have
to move further up the echelon of systems: It might be best to
relax both of these constraints and increase the accuracy of the
ground data-handling process to get the optimal solution for the
problem of increasing the kill probability of the interceptor
plus ground radar system. A still wider analysis of the problem
of defending the SAC wing might indicate solutions in which interceptors
were not involved at all. Local defense missiles, for example,
might be a better way to do it, or some form of passive defense.
Specific constraints are necessary at every point, but none of
them can be regarded as final.

The history of the B-36 illustrates that no set of
specifications such as 4,500 nautical mile combat radii, Mach
number equal to 2.5 etc. can be regarded as final. It represents
a choice among a lot of other alternative combinations of speed,
altitude, radius, etc. and inevitably compromises some performance
in order to better others. Whether or not this is a good choice
depends on a variety of uncertain variables whose interaction
we are bound to get to understand better in the process of design
and development, and whose aspect may change over time.

The requirement that air base design concentrate
elements in order to keep utilities to a minimum was sensible
so long as these bases were not seriously subject to enemy bombing
attack. Up to fairly recently overseas bases were designed for
protection only against high explosive attack, and ZI bases were
designed with no protection against enemy attack whatsoever.
Given a growth in enemy capability it is clear that we must choose
a different combination of utility cost, operational convenience,
and resistance to attack. The Air Force has therefore re-evaluated
this objective.

It is not merely that changing circumstances alter
cases, that what was a correct choice at one time is outmoded
by events. At any instant of time choice is a very complicated
act. The crew dosage limits for nuclear-powered aircraft, ANP,
which I mentioned a short while ago, will illustrate this point.
The question of these limits is central in the ANP program.
To reduce the dose, we must increase the shield. But when we
add such dead-weight to a plane, we must increase the gross weight
by a very much larger amount. Implicit in the limits set is the
assumption that nuclear-powered bombers will be used in time of
peace frequently, the way we use chemically-fueled bombers. But
if the crew is to fly frequently in time of peace, it must receive
a very small hourly dose in order to keep life-time doses within
tolerable bounds. Very small doses mean very large shields, and
large sacrifices in other parameters. The peace-time training
requirement, then, which has an obvious utility, has also a large
cost, and therefore needs looking into. Frequent nuclear operation
in time of peace involves large costs, not only in aircraft design
to protect the air crew, but also in base design and base operation
to protect the ground crew. The Air Force contractor, as I have
said, must of necessity accept as fairly firmly given, the Air
Force statement of requirements, so that he can get on with his
job. But the Air Force itself and the systems analyst must continuously
re-evaluate these objectives in terms of what they cost and in
terms of the alternatives they sacrifice. The analysis of just
such constraints is one of the most fruitful areas for systems
analysis. Analysis of this hourly dosage constraint might lead
to the design of ANP systems which exploit to a maximum the very
different needs of operation during an extended period of peace
and operation during a short atomic campaign.
In summing up what I have said on the subject of
objectives and constraints, I want to stress that the goals set
down in the course of Air Force policy decision should never be
taken as final. Ends are means to further ends and on occasion
must themselves be evaluated. One man's means is another man's
objective.

Broader Air Force Objectives

If we are to evaluate the fairly narrow or specific
objectives we have referred to so far in terms of broader ones,
what are some of these broader objectives? Are they final? (You
may observe that I wrote formula (4) in a way that suggests that
they are not. I ended up with some dots -- "Oi+2
 . . ." -- suggesting "and so on.")
The objective of defending a SAC wing is interdependent
with the objective of defending our cities. And it is subordinate
to the goal of using SAC to destroy such enemy target systems
as the enemy SAC, cities, and ground forces. But these target
systems themselves are interdependent. Joint capability for their
defense and joint capability for their attack are relevant considerations
which will affect the design and the results of a systems study.

Moreover we might--I would argue sometimes must--consider
a still broader menu of Air Force objectives. If we were to set
up a comprehensive menu, this would include many things that would
be very nice to have, some we'd willingly settle for, and some
items which we would regard as the minima necessary for life.
let me discuss some of these alternatives under three heads:
1) provocation, 2) deterrence, and 3) capability of winning the
war once started.

First, provocation. It is clear that in the past
there have been advantages in getting into at least some sort
of war. And, while this is a delicate matter, it is also possible
that in the future there might be some sorts of conflict which
would be to our advantage. This depends on the nature of the
damage done to us, both physically and in our relations to the
rest of the world, as well as on the certainty with which we could
achieve our objectives in the war. In any case it is apparent
that one might use the Air Force to help stimulate this hypothetically
advantageous conflict. While this is clear, I think it is also
clear to most of us that there are a great many advantages in
not getting into World War III.

This brings us to deterrence, the second category.
This is frequently, and I think correctly, stated to be the Air
Force's most important objective. If the winner in World War
III could conceivably sustain thirty million casualties it is
clear that there might be some difficulty in defining the notion
of winning the war game. The symmetrical thermo-nuclear war game
is what game theoreticians call non-zero-sum. The "winner"
does not come out with an increment in utility which equals in
amount the loser's loss. In this case it is very important to
concentrate on the cold war game whose pay-off is the avoidance
of the non-zero-sum thermo-nuclear game, in which both sides are
merely trying to keep their catastrophes to a minimum. This is
the function of deterrence.

The third category, having a capability of winning
the war once started, has already been illuminated some by the
comments on deterrence. We would like this capability, not for
the sake of using it so much as to avoid the occasion for its
use. And the difficulty of defining winning, which I have suggested,
indicates also that there is a whole spectrum of victories which
we might arrange in order of decreasing desirability:

victory in style: for example, being sure that
all our cities and those of our friends and allies will survive;

at least all our cities;

anyway a fifty-fifty chance for a significant
number;

technical win--two Americans surviving and only
one Russian.

We would want in such a war to have a high confidence
that we could destroy the enemy's economy and administrative centers.
Or at least a good chance. And on the other hand we might also
consider the advantages of having something left to reconstruct
of the enemy's economy and population.

Overlap and Divergencies

The variety of all the things we want sets quite
as much of a problem for the analyst and the decision-maker as
does the multiplicity of alternative measures for achieving these
wants, and the huge number of things which can interfere. For
these objectives are interdependent. Getting one affects the
satisfaction of another. Sometimes favorably: we kill two birds
with one stone, or a plant as well as an administrative center
with one bomb. And even if the interdependence is favorable for
the fulfillment of the real problem, it may complicate the analysis.
We find ourselves in a welter of considerations of such matters
as the incremental cost to do job J1 with weapon system
W1, when in
any case you are doing job J2 with weapon system
W1, and comparing
these results with similar results for weapon system W2.
At other times the interdependence is unfavorable.
Suppose in our birds and stone example, for one reason or another
it is important for us to discriminate. Suppose, for example,
we want to attack counter-force targets and not cities.

Consider some hypothetical campaign comparisons between
two strategic bombing systems, one based and operated overseas
and the other based in the continental United States and in this
example to be fueled exclusively by air. Figure 2 depicts their
(purely hypothetical) comparative effectiveness in a counter-force
mission, given U.S. initiative. The overseas based system destroys
three-fourths of the Soviet strategic force (SUSAC); the U.S.
based system only one-fourth.

How do these systems make out against Soviet cities?
And (remembering this is a two-sided war) what, in the face of
our attacks do the Soviets do to our cities? Figure 3 purports
to show this. The overseas based system knocks out well over
three-fourths of the Soviet city targets and, because of its extensive
demolition of the Soviet long-range air force, the remainder are
unable to saturate our defenses and do more than a moderate amount
of damage to our cities. This would be winning the atomic war
in style. The U.S. based air refueled system does considerable
damage to his cities--gets about half of them--and so could be
at least a moderate deterrent, but it does not succeed in staving
off an even more massive destruction of our own cities.

Would the capability shown for the overseas based
system be a deterrent? The answer to that might seem to be a
resounding "Yes!" But Figure 3 like Figure 2 assumed
we had the first strike and after all what we are supposed to
be deterring is his strike. What would happen to him if he did
strike first, assuming in one case that we have the overseas operating
base system referred to and in another case assuming the U.S.
based air refueled system? Figure 4 shows this for our two fictitious
systems. With the first strike the enemy destroys almost three-fourths
of our cities, a full three-fourths of our overseas based SAC
and the undestroyed remainder of our overseas force manages only
a very minor retaliation against Soviet cities. Here he
wins the war in style. The ZI based system on the other hand
which did not do so spectacularly well where we had the first
strike does not do much worse when the enemy takes the initiative;
at least the enemy does not come off unscathed. Which of our
two hypothetical systems then is the better deterrent? It seems
fairly clear that in this example at any rate it is not the overseas
operating base system.

Among the overlaps in our major objectives we should
mention then that our capability of winning the war (objective
three) and especially of winning it in style is a deterrent (objective
two) provided that we can win it even if he strikes first,
that is, even if he does what we are trying to deter him from
doing. If this proviso is not fulfilled and the outcome of the
campaign depends entirely on who strikes first we have no deterrent
but only a provocation and in this case an unwelcome one. The
analyst must always be wary that the specific methods of accomplishing
one objective do not compromise some other even more important
objective. This is a caution which must be observed in evaluating
alternatives in terms of our major objectives as well as in the
case of our narrow objectives. While I need not point out that
there is a distinction between provocation and deterrence there
are many less obvious points of divergency and distinction between
the job of deterrence and the job of having the capability of
winning the war once started.

Let me illustrate this point with an example which
is, alas, familiar to all of us: the activities of the traffic
cop. The city fathers would like to reduce the number of violations
of the law. They would also like to fine or put in the clink
as many violators as they can. There are two well known alternative
techniques for accomplishing these nefarious ends: one is the
familiar ambush technique; the other is sometimes called the visible
patrol technique. The first increases the probability of interception
and arrest. The second discourages culpability. Now if our goal
is to maximize the number of speeders punished, or the proportion
of speeders punished, or the total of municipal revenue through
fines, ambush, however uneasy such sneaky tactics make us, is
very likely the best way to do the job. If our goal, on the other
hand, is a reduction in the total number of traffic accidents,
say, or in the number of attempts to violate the law (even if
on the whole such attempts as take place are more likely to be
successful, since better informed), it may very well be that the
most frequent, obvious presence of policemen capable of massive
and instantaneous retaliation against speeders would encourage
caution, and so achieve such goals best. (It might also avoid
some of the undesirable side effects of the ambush technique such
as the occasional, faintly ludicrous vision of a burly grown-up
on a motorcycle trying to look invisible behind a palm tree, with
its undoubtedly crucial dissolving effect on our respect for municipal
authority.)

Let me offer an actual example which concerns the
vital problem of making sure our strategic force will survive
any enemy attack, and so is related to the hypotheticals just
dealt with. One of a great many methods that I have heard suggested
for protecting SAC would reduce the chance of SAC's being hit
essentially by deceiving the enemy into thinking that SAC was
very vulnerable some place where in fact it is not. The enemy,
the argument runs, would attack our strategic force in this apparent
soft spot, expends its bombs fruitlessly and so gain us a crucial
advantage in winning the war. The particular line of deception
that was suggested in this argument involved costs of over a billion
dollars and it seemed clear that the deception might not work
even then. Fortunately, there are alternative deceptive tactics
that are cheaper and more deceptive. But the essential weakness
of the argument was that it ignored the fact that if the enemy
answered this invitation to clobber a supposedly soft SAC with
a joint attack against our cities and our strategic force he might
very well miss SAC but, unfortunately for us, hit Washington D.C.,
New York, Los Angeles, and the rest of our major cities. He would
then open a war he might not have dared to start unless he had
been deluded into thinking he could destroy our retaliatory force.
Deceiving the enemy into thinking SAC is vulnerable some place
where it is not ignores the fact that SAC's deterrent effect depends
on a reputation for invulnerability everywhere.

The possibility of overlap and divergency among our
objectives must affect our analyses. This can happen in the formal
part of the analysis, perhaps by forcing a broader criterion of
choice encompassing the inter-dependent objectives. Formal introduction
is not always easy, as our deterrence example suggests. But if
they cannot be introduced into the numerical model, neither can
these difficult-to-measure interdependencies be banished from
our interpretation of that model. They must qualify the numerical
comparisons.

Deterrence in general does not enter directly in
our models. We make a bow in the direction of deterrence in the
prefaces to our reports, but seldom recur to the subject in the
body of the analysis. The analysis measures our capability of
performing some tasks during the war itself. But if it is hard
to assign numbers to deterrence, in comparing systems we should
at least check for possible disadvantages one or another of the
systems may have, considered from the standpoint of this important
objective. And, I think more can be done by analysts in this
difficult area. I shall refer to a class of measures which are
not completely satisfactory in the sense that they are inadequate
to provide us with high-confidence capabilities for success in
various tasks during the war, and yet might have a large deterrent
value. Some of these measures might be very cheap and their exploration
fruitful, even though they give us no firm assurance either in
the cold or in the hot wars, but merely make it less likely that
the cold war will turn hot. Such an objective is a modest one
perhaps, but hardly to be sneezed at. I will return to this class
of unsatisfactory but valuable measures after saying a little
about the enemy's objectives and their relevance to a systems
analysis.

IV. The Enemy's Objections and Agreements.

In talking of the Air Force objectives which a systems
analysis might help to further, I listed a whole hierarchy of
desires ranging from delectable to desperate minima. I said nothing
of the enemy's objectives and the objections he might have to
our fulfilling our own desires. But of course it is part of the
essence of the problems we are considering that they must always
be looked at symmetrically. The enemy has goals which are counterparts
of ours and in direct conflict with them. (He also, fortunately,
has some goals in common with us, but not enough to make our problem
a simple one.) Clear as this is in principle, it is frequently
forgotten both by analysts and decision-makers. And it is not
easy to introduce the enemy into our calculations in a way that
assigns him the degree of freedom, which he in reality has, to
louse up, say, our simple desire to maximize the number of his
cities destroyed. In considering the enemy's active defense through
which our offensive systems must penetrate, do we take into account
the devices open to exploit the peculiar weaknesses of each of
these systems? In most of the analyses I have seen, either
formal systems analyses or staff papers, I think not. MSF
is deficient here, but hardly more so than the run-of-the-mill
study.

For example, MSF does not permit the enemy to adjust
his defense budget so as to spend more money on local defense
to combat systems primarily vulnerable to local and not area defense.
This is bad. But MSF leaves the enemy offense out of
account altogether. While differential air attrition is looked
at, differential ground attrition is not allowed to figure at
all. In this respect, unfortunately once again, MSF is not below
standard. And this deficiency is by no means trivial. RAND has
found that the effects of ground attrition in a strategic bombing
analysis can frequently dominate the air attrition effects. Some
analytic empirical method of dealing with ground attrition, however
grossly, is in general essential. I stress empirical method because
I have come across a recent study of some strategic bombing systems
in which the outcome of the comparison was determined almost entirely
by costs of defending SAC bases on the ground. The whole very
considerable margin of superiority of the preferred system over
the rejected system was attributable to these defense costs.
But unfortunately these costs were wholly arbitrary and not themselves
the results of analysis. While this arbitrary assumption was
embedded in a fairly elaborate model, it hardly fulfilled the
requirement that I am describing, namely taking enemy offense
into analytic and empirical account.

Mr. Hitch mentioned games and game theory as devices
for taking enemy reactions explicitly into account. Game theory,
as he stressed, is helpful conceptually, though still far from
direct application to any complex problem of policy. Games can
be a useful component of a systems study, and Mr. Specht will
have a good deal more to say on this. I would like to stress
here that it is essential to take enemy reactions into account,
and that this need not be done in the framework of a formal game,
with its apparatus of explicit rules covering permissible moves
and determining the pay-offs for each play. For example, RAND
analysts, in conducting map exercises to determine the performance
of alternative defenses typically would try some defense tactic
and then try to figure the best means the enemy had available
for countering this tactic; then would try another tactic, again
examine the possible counter-moves, and so on. In this way each
strike calculated was actually the result of a rather extensive
canvas not only of our tactics but of enemy reactions. Matching
best enemy counter-moves to our own choices is also an important
part of RAND's work on airbase choice. This matching is one kind
of minimax analysis. Such information attempts to introduce the
enemy by letting him do his worst to our forces and then seeing
which of our forces accomplishes the job most effectively in the
face of this best enemy attempt, are sometimes more informative
than a formal game. Too frequently the real questions in doubt
concern the rules of the game, whereas the players of a game are
likely to be concentrating all their ingenuity on how to exploit
the rules.

But whether by use of formal games or by some other
device, the enemy must be present in our analysis, as he will
be present in the war: stubborn and uncooperative, complicating
our analysis as well as our life. Sometimes the recognition of
the enemy's potentialities is very unpleasant. In talking about
how to conduct a campaign to destroy his force on the ground before
it hits our forces and our cities, the advantages of having the
first strike are obvious. Without it we are locking the barn
door after some and possibly most of our forces are stolen. (It
is difficult not to conclude that we just can't countenance his
getting the first strike.) But one can conceive of analogous
conversation among the Russians about the problem of destroying
our Air Force. If the first strike is good for us, he undoubtedly
would like it too. This is just the sort of thing that is difficult
to negotiate with Communists. Moreover, since he has some intrinsic
political advantage over us for engineering a surprise attack,
we must contemplate his getting the first blow as one strong possibility.
This is one contingency we must plan for.

How should a systems study deal with uncertainties
as to the enemy's capabilities and intentions? We have seen one
way of avoiding the problem where the enemy was considered at
all was to limit consideration only to some fixed composition
of offense or defense which is not allowed to shift in response
to aspects of our strategy sure to be known to him. This makes
a comparison of alternative systems subject to at least an unconscious
bias in favor of systems that deviate from the norms this fixed
force might have been invented to counter. And it makes the problem
of meeting the enemy too easy. We assume some fixed combat ceilings
for his fighters and then devise a bombing force capable of flying
slightly higher. Or we assume some specific limit to the range
of his local defenses and then work out a device for sending off
bombs from just outside of this boundary.

But what is the alternative to this? To assume no
resource performance constraints on his part at all? This would
simplify analysis too by making the problem insoluble. If our
resources are limited and his are not, not much calculation is
required to figure the result. And we hardly benefit by merely
assuming we have an absolute defense against his hypothetical
absolute offense. There is a germ of wisdom contained in such
attempts to release the enemy of any constraints whatsoever.
It suggests that in addition to trying various reasonably estimated
constraints, it is good to find the enemy capability at which
our strategy breaks down. This of course will always occur at
some finite point of enemy capability.

In general then it is important to make bracketing
estimates of at least the general resource limitations in order
to keep the subject short of the realm of science fiction. But
on the other hand we must give the devil his due and permit him
such freedom of allocation within these resource constraints as
are applicable for the time period under consideration. This
means that for development problems there are very few specific
resource constraints, that is, inflexibilities, that we can safely
assume.

The trouble with most air attrition models that have
been used to answer development questions is that they treat such
questions as if they concerned procurement or operations. Each
of a few offense vehicles, for example, will be represented by
a specific combination of numbers designating speed, altitude,
payload, CEP, etc. Each is matched against the same fixed area
and local defense force deployed in the same way. But even if
such a model covered only procurement and operational alternatives,
it is clear that such a procedure omits significant possibilities
open to the enemy. And ourselves. For even when we are buying
an item already developed, we invariably find it open for some
growth and adaptation with changes in the state of the arts during
its period of use. So the B-36 acquired jets. Such models omit
much of the real freedom of choice available to both sides.

For development problems in particular we can't take
performance parameters as fixed. We need some technique for picking
good performance requirements, useful goals for the designer.
How might we go about this? I have suggested that one method
would be to test each system which fulfills a given set of performance
goals against an enemy counter strategy which, within only general
resource constraints and using information reasonably likely to
be available to him, is devised precisely to exploit the weaknesses
of the system we are testing. It is clear of course that the
problem of picking optimal or even good matching strategies for
the enemy and ourselves increases in difficulty as we consider
strategies more distant in time. We will have to consider not
just a few air battles involving specific bombers versus specific
fighters, but very large families of battles of offensive vehicles
of various types versus various mixtures of local and area defenses.
And large families of circumstances involving differing resource
allocations by both ourselves and the enemy among active and passive
defense and offense.

One way of dealing with uncertainties as to the enemy
capabilities and intentions then, is to assume that, within limits
set by his resources and the time and information available to
him, he will do what is from our standpoint the worst. I do not
think that this is the only kind of enemy strategy to consider.
There are some non-optimal strategies is even more difficult
in analysis than dealing with optimal ones. If we're lucky there
may be only one optimal strategy, but it is clear that there
are always lots of bad strategies. Which of these are worth looking
at? There is at least one worthy of careful attention. This
is the sort of strategy we may call an "inert strategy,"
that is to say, one in which he continues to behave as our intelligence
tells us he is presently doing, even though circumstances, and
in particular our own strategy have changed. Bureaucracies have
a great deal of inertia and we must not overlook this fact. He
might, for example, have a rather stupid strategic base system.
I have already indicated that I think that it would be very unwise
to depend exclusively on the assumption that he is going to be
stupid. But it would be a great mistake to ignore this possibility
and so find ourselves unable to exploit any deficiency he might
have. When you work on such problems as the job of destroying
his strategic force, which can be very difficult if he behaves
intelligently, you will want to combine such moderate success
as you are able to assure in the face of an intelligent enemy
defense with a capability for a resounding victory just in case
he is "inert." Inert strategies are important as benchmarks,
but they also are useful to consider in developing low-confidence
measures. And, as I have said, given the uncertainties and difficulties
the Air Force confronts we can hardly afford to neglect such measures.

This example displays the enemy in his familiar role
of being precisely in conflict with us. The next subject concerns
some items in which his interest coincides with ours. This is
the interest in not starting something in which both sides will
get thirty million or so casualties. It is only because the enemy
has such points of agreement that deterrence can work. This brings
us once again to the subject of deterrent measures, which as I
have indicated could stand further analysis.

V. The Modest Value of Mutually Unsatisfactory
Strategies.

I have mentioned that measures which give us a high
confidence of destroying the enemy's cities or military potential
are a powerful deterrent. To have such measures fulfills our
fondest desires, precisely because they decrease the likelihood
of war and at the same time provide powerful assurance just in
case war does break out. While it is possible to obtain some
such high-confidence measures in critically important areas, this
is not always the case. And therefore it is useful to consider
some measures which fall short of providing us with such high-confidence
war-time capabilities.

You will recall that I listed several high-confidence
objectives in describing the broad categories of Air Force goals.
The first I mentioned was our desire to have a high degree of
confidence that all of our cities could survive an enemy surprise
attack. Let's say we mean by high degree of confidence at least
90 chances our of 100. Another high-confidence objective which
is more realizable is the goal of maintaining a SAC of which a
large and powerful portion will remain undestroyed by an enemy
surprise attack.

The enemy also has some fond desires which are symmetrical
to these. He would hesitate to go into a war if he could not
be fairly sure that he could destroy enough of our urban areas
seriously to reduce our military potential. Even more obviously
he would hesitate before undertaking a surprise attack which left
our strategic striking force in a position to return a devastating
blow. Let's say, then, that we would like to preserve our striking
force with very high confidence (at least 90 chances out of 100).
He would like to have a high confidence (at least 90 chances
out of 100) of destroying all of our SAC not sure to be handled
by his defenses. Now suppose we have such a high-confidence measure
for a certain fraction of SAC, and then think up another measure
which gives us a fifty-fifty chance of preserving a considerable
additional fraction. It is clear that this additional measure
does not fulfill our fondest desires. On the other hand, it should
be observed that it does prevent the enemy from having a better
than fifty-fifty chance of realizing his fondest desires. It
makes a surprise attack a gamble and therefore acts as a deterrent.
Particularly where we don't have high-confidence measures, the
value of such low-confidence measures is clear.

How basic is the distinction between high- and low-confidence
measures? Do two or three low-confidence measures add up to a
high-confidence measure? Not necessarily. In low-confidence
measures what we are trying to do it to decrease his confidence
rather than raise ours. One of the ways we might decrease his
confidence with respect to the success of some particular attack
strategy might be to increase the variability of his result, even
if we don't affect how it comes out on the average. This would
increase the risks for him, and would help the deterrent function
typical for the low-confidence measure. But it also means that
since we have increased the variability, we have reduced our own
confidence too. Therefore our fondest desires are not satisfied.
That is one reason we must continue to seek high-confidence measures
where we do not already have them. They can't be replaced by
low-confidence measures. However, it is important to study systematically
this less ambitious class of measures, especially where we are
not able to find means of satisfying our more ambitious goals.

VI. Uncertainty and the Design of Systems Studies.

Low-confidence measures offer an example of how we
might exploit uncertainty. But I have said enough to indicate
that whether it is useful or merely annoying, uncertainty is a
central problem in the design of systems studies. (Mr. Marshall's
lecture is devoted entirely to this subject, but you will observe
that most of the speakers are forced to engage this dragon.)

We are uncertain, then, even as to what we want to
do, and certainly as to what we can do, and what the enemy can
and will do, and as to the physical and political environment
of our and his actions. How do we deal with any of these uncertainties
in designing a systems study? I have said a little about the
treatment of enemy intentions and capabilities. How about the
first of these uncertainties, the uncertainty as to our objectives?
This should be somewhat easier to handle than the other dragons.

There are several ways of dealing with the problem
of framing an objective for our analysis, which is both workable
and of some policy interest. Some appealing methods merely avoid
the problem. For example, we might 1)frame the objective narrowly
enough to measure, and so make it workable, but also make it too
narrow for validity or interest. Some of the issues raised in
the course of the B-36 history illustrate this. We are clearly
being too narrow if we select one performance characteristic and
simply maximize this, or maximize it subject to a few constraints.
For example, if we attempt merely to pick the fastest plane,
or the longest radius plane. The longest radius plane possible
in the current state of the art of power plant and air frame design,
neglecting any considerations of payload, speed, etc. might travel
some 7500 nautical miles and return, according to the lecture
by Mr. Rumph earlier in the series. Mr. Rumph stresses, however,
that such a plane would hardly do a militarily useful job. We
might therefore specify certain minimum performance in speed,
altitude, and payload, etc. and then call for the maximum radius
plane subject to these conditions. Alternatively we might maximize
speed, subject to certain minimum requirements placed on radius
and the other performance parameters. Both these courses are
simple, but leave us no method of choosing between them. Nor
do they suggest precisely what minimum constraints to place on
the performance parameters we are not maximizing. For this reason,
the selection of general operating requirements for SAC bombers
cannot be solved so simply. Such a procedure merely evades the
problem.

A second way of evading the problem might be to take
the opposite course, formulate the objective with perfect breadth,
but fatal hallowness. We do this, for example, when we merely
formulate criteria which appear to test for a variety of contingencies,
but don't, because of the presence of a variable which cannot
be determined in the degree of specificity needed for decision.
It is easy, for example, to write out criteria for choosing the
best system considering the maximum expected performance under
a variety of contingencies, each of which is supposed to have
a specific probability associated with it. The contingencies
might in one case be: outbreak of war next year, and the year
following, and the year following that, and so on. In another
case they might be: defection of England, defection of Libya,
defection of Canada, defection of Texas, and a series of similar
catastrophes. But if our choice depends on our being able to
assign exact numbers to the probabilities of each of these
contingencies, such a formulation does not advance us very far,
since none of us knows how to do this. (The case, I shall argue,
takes on a different aspect if we can find or construct systems,
the choice among which depends only on very gross inequalities
in some such probabilities.)

In going about the job of framing workable and useful
objectives, it is not inconsistent with our cautions about narrow
criteria to use narrow criteria as an intermediate step. In fact,
this is one of the most useful ways in a systems study to frame
workable and useful objectives. Ideal kill potential is sometimes
used in this way in RAND analyses of air defense. Intermediate
criteria enable the comparison of large subsets of alternative
weapons and the sifting of grossly inefficient ones. But the
comparisons must be made carefully and only between devices that
are essentially similar in the way they would enter broader optimizations.
For example, an analysis of air defense may make such direct
comparisons among defense weapons with ranges of say, 15 to 25
miles, and it may make direct comparisons among weapons of 200
to 300 mile radii. But it must not use the kill potential concept
to compare the 20 mile radius weapon with the 200 mile radius
weapon. Similarly a RAND study of airbase choice used as one
of several intermediate criteria "maximum number of enemy
targets killed in the face of enemy defense (but neglecting enemy
attack)" and as another, "maximum number of bombers
surviving enemy attack on the ground." In some cases, systems
could be compared here usefully, even though they were expected
to enter broader optimizations with contrasting success, because
the difference between the systems was likely to be emphasized
by taking a broader criterion and including certain additional
variables. For some of the comparisons, in other words, the intermediate
criteria provided an a fortiori argument.

But such intermediate criteria fall short of complete
trustworthiness. For example, let us take the criterion of maximum
number of bombers surviving an enemy attack on the ground. Such
a criterion neglects the offensive function of SAC (just as the
other intermediate criterion cited neglected defense). Therefore
it is not hard to construct a system which would look very good
on this criterion, but would fail in performing the essential
strategic function. We might envisage a system which kept the
parts of SAC bombers unassembled, and buried each under concrete
some place in the Antarctic far beyond the reach of Soviet bombing
attack. Our bombers would in this case be quite safe. But so
also would the enemy. Our bombers would hardly be usable for
an offense against him.

This is an extreme example, but it is only an extreme
form of systems suggested all the time. Some less extreme forms
of long-range operation sacrifice more bombers in order to purchase
tankers than they save on the ground. There are analogous difficulties
with some extreme forms of dispersal and shelter. We must then
use a broader criterion which takes account of the fact that in
defending SAC, we are defending an offensive force, and therefore
the measure of success of any defense must reflect the performance
of the offensive job. One such broader criterion is "least
cost to destroy any given enemy target system (or maximum enemy
targets killed for a fixed budget) in the face of enemy attacks
as well as enemy defense." Our Antarctic SAC would show
poorly by such a criterion. And so do several less extreme proposals.

This spreading hierarchy of working criteria can
be related to our example of a little while back. You will recall
that Figures 1A and 1B represented an unlimited sequence of increasingly
comprehensive systems and the corresponding sequence of formally
labeled but unspecified contractor and Air Force objectives.
Figures 5A through 5E suggest criteria which might be useful at
corresponding phases of the work:

minimum cost for airborne radar with a given
performance,

maximum kill probability per pass for given interceptor
investment,

maximum area kill potential,

maximum number of our bombers surviving an enemy
attack,

maximum enemy targets killed considering enemy
attack and defense.

We needn't stop here. As I have stressed, if we
are to take into account the problems which motivate the Air Force
desire for long-range operation, we must broaden our criteria
still further. We should consider the performance of various
systems in a variety of contingencies. We must consider not only
the expected case, but also the eventualities against which the
Air Force must insure itself, even though--like the events against
which the B-36 hedged--they may not occur. I will have more to
say about contingency planning in the final section of this talk.

Besides the uncertainties as to our objectives and
criteria for evaluation, the design of our studies must take into
account a number of other sorts of uncertainties. Some of these
such as the weather, are not likely to be resolved. Mr. Marshall's
lecture deals with techniques for taking such uncertainties into
account as well as others. There are some uncertainties which
might be resolved by tests within our control. Let me mention
an example. The behavior and loading of structures under very
extreme over-pressures is not well understood today. One of the
results of recent systems analysis suggests that highly resistant
structures might have a number of important military uses. A
policy implication of such an analysis is that we should undertake
the tests to learn more about the feasibility and costs of resisting
extreme over-pressures. In this case a result of the analysis
is a program for clearing up an important item of uncertainty.

But though some uncertainties can be resolved, others
cannot and the problem of uncertainty remains central in any systems
study.

VII. Systems Design Versus Systems Analysis

Do the multiple uncertainties we have outlined make
analysis impossible or at any rate fruitless? Are we optimists
if we hope to find the one alternative which is the optimum of
all the millions? It would appear that dominance is a miracle.

Let me recall that these uncertainties are not merely
a problem for the analyst, but one of fact. The factual indeterminacy
of the political and physical environment, the variety and instability
of our objectives, and the multiplicity and uncertainty of the
obstacles the enemy can interpose, suggest that we must design
systems which are good or viable in a variety of circumstances.
That is to say, the problem is one of devising flexible, strong
systems, not only taking systems that have so far been suggested
and comparing them. Inventiveness in systems design has a double
function. The first is its primary function, that of helping
solve the decision-maker's problem of being ready for many contingencies.
The second function, dear to the heart of the analyst, is that
of simplifying the analysis.

Let me offer one example of how this happens in the
small, so to speak, in the daily business of the analyst. In
the course of a broad study of bomber systems you have to worry
about the vulnerability of various components of a bombing system
to enemy bombing attack. The ground facilities including the
runways are one such component, though it happens that the runways
can be made one of the least vulnerable elements. Getting a model
for the vulnerability of a runway is very considerably complicated,
if we have to worry about not only such questions as the maximum
continuous length of runway surviving, but also whether there
is a continuous clear path along some taxi ways providing access
to this surviving length of runway. In a so-called Monte Carlo
random bomb drop which we might program for the machine, the number
of such possible paths of access which we might have to ask the
machine to examine is very large and might be prohibitively expensive
if we were trying thousands of repetitions of bomb drops as one
small component of a much larger investigation.

One way to go about this is to multiply the number
of access taxi ways enough to make it very unlikely that there
will be any length of runway long enough to be usable without
access. Multiplying access taxi ways is quite inexpensive, not
only by comparison with total systems costs, but also by comparison
with base installation costs. If we do this we have a taxi way--runway
system which is considerably stronger. We can have a higher confidence
in its survival. At the same time the small excursion necessary
to approximate the required number of access taxi ways makes it
unnecessary to complicate the analysis by considering the problem
of access.

Analysis is easier for strong systems. It is also
easy for very bad ones. The really bad ones don't hold us for
very long because, for example, we needn't worry about the interdependence
of a destroyed plane and a destroyed fuel system. If the facility
has many critical vulnerable elements, the capability undestroyed
by bombing will be very, very low, and shown so by a simple measure
of the percentage killed of some one critical, badly damaged element.
A subtle analysis could measure more closely the extent to which
even the small surviving elements are rendered useless by the
destruction of complementary items. Why bother? We have already
seen that the system is very bad.

Similarly if we so design a system of elements so
that the chances are very small that any critical element will
be destroyed for reasonable ranges of bombing attack, the interdependence
questions are quite relaxed. In some cases a quite inexpensive
amount of over-design furnishes an a fortiori argument.

Hundreds of such problems occur in the course of
a systems analysis. It is always important not to take the systems
as they come, but to modify them in the light of inefficiencies
revealed in the course of analysis. The aspect that I'm stressing
here is that strong systems permit a fortiori arguments.

Are there any principles for designing strong systems?
There are no prescriptions for ingenuity, and the design of Air
Force systems must proceed on the basis of the empirical characteristics
of Air Force problems. Some of these are pervasive enough to
suggest certain guide- lines. I will mention a couple. One is
to exploit the great difference between the war and peacetime
requirements imposed on the system. We might call this "The
Thermo-nuclear-War-Is-Not-Peace Principle." Another is to
exploit, in devising strategic systems, the very different requirements
for the approach and penetration segments of the mission. This
is the "It's-Hotter-In-The-Combat-Zone Principle."
Let me offer an example of a system that ingeniously exploits
this second difference.

With a fixed state of the arts, and an airplane of
given size, higher speed can be obtained only at the cost of shorter
range. Supersonic speed is very useful in reducing attrition
while in range of enemy fighters, but not so important for the
long leg of the mission between our bomber bases and the edge
of the enemy defended area. The B-58 design represents an ingenious
compromise between our design for great over-all range and high
speed, by including "supersonic dash" capability for
use only when penetrating enemy defenses, through the use of afterburners
on the engines. In this way it is possible to attain virtually
all the benefits of supersonic speed and subsonic range.

There are a number of examples of weapons systems
which exploit the difference between peace and atomic war to advantage.
Consider the case of shelters against atomic attack. These are
called for two very different sorts of loading. Over an indefinitely
extended period of peace, it will be subject to the same sorts
of forces as normal civilian structures in the same locality.
In a short atomic campaign it will be expected to receive very
much more severe loads, but only once or twice, and then it will
have fulfilled its entire purpose. Intelligent design practice
takes advantage of this difference. The war-time design loads
are allowed to exceed the elastic limits of the materials in the
structure and work distortions which would be unacceptable in
civilian use or in military use for that matter if they were repeated
very frequently. They do no harm, however, to the war-time function
of these shelters. Other examples could be cited of systems which
exploit the great difference between the peace and atomic war-time
requirements. Earlier in the lecture I suggested in connection
with nuclear-powered aircraft that the shielding problem both
of the air and ground crews might be attacked in a way that could
exploit this difference. The ground-refueling method of operating
bombers is another example of a system which exploits this difference
much more completely than do air-refueled systems. Air-refueled
systems haul POL which is the cheapest and bulkiest element in
the weapon system long distances by air in time of war. The ground-refueled
systems haul it the long distances overseas by slow freighter
in time of peace and, for the most part only in time of war or
on maneuver, pick it up in aircraft. Some of the contrasting
forms of dispersal make a good deal of this difference by avoiding
the high logistic and operational costs of operating separately
in time of peace limiting the time of dispersal essentially to
the war-time emergency. So also some systems exploiting assisted
take-offs as an emergency device.

How about the possibility of devising systems which
are good in the sense that they can meet a variety of contingencies?
The B-36 example illustrates the Air Force desire to have a hedge
against political and military bad luck. And the uncertainties
we have outlined suggest that this is a good idea.

Mr. Hitch worked out an example of the problems of
dealing with uncertainty which relates to the specific uncertainty
against which the B-36 was a hedge. I would like to use his example,
and to expand on some of the considerations he made. Table 1
which Mr. hitch used shows two systems, one dependent on overseas
bases, and one made up of very long-range bombers operating from
the ZI. It shows these two systems operating under two conditions:
1) with overseas bases available, and 2) without them. I would
like to expand both the list of alternative systems and the list
of alternative contingencies. Figure 6 does this and also shows
in a few of the cases how they might be supposed to fare in the
various contingencies.

Table 1

Targets Destroyed by Hypothetical Bomber Forces

If Overseas Bases Available (a)

If Overseas Bases Not
Available (b)

Expect Outcome if Probability of (a) = 90%

Worst

System dependent on overseas bases

100

20

92

20

Very long-range bombers from ZI

50

50

50

50"Minimax"

Aside from the state of the weather, the six contingencies
shown in Figure 6 relate to distances from enemy territory: loss
of all bases within 250 miles of Russian boundaries, loss of all
bases within 500 miles and so on in several lumps. We might of
course lose bases in different sorts of discrete lumps, say all
bases in certain politically connected areas. But this illustration
will suffice. You will observe first that the contingencies listed
while only a small subset of those possible are rather more extensive
than those presented in Table 1. Having all our overseas bases
or none are extreme cases. We have a very large number of bases
in a couple of dozen different countries. And while the behavior
of these countries is not by any means completely independent,
there is a considerable amount of independence.

The probability that we will lose all such bases,
including, say, Canada, is finite but quite small. I have also
included Maine as a possible defection to indicate that anything
is possible. We can't even be sure of Limestone. (The last contingency
shown in Figure 6, the loss of all bases within 4,000 miles of
the Russian border, would include this disaster as well as the
loss of Canada.) You will observe also that the list of alternatives
for operation under these varying circumstances is also now very
long, though by no means exhaustive. It includes some systems
which so to speak can only operate in lovely weather. This for
example is literally true of the pure fighter-bomber limited-radius
system which has no special tanker supplement and no possibility
of converting its bombers into tankers and has resolved under
no circumstance to adopt desperate measures like one-way operation.
Its score is terrible in bad weather, excellent in good weather,
provided we have bases within 250 miles of enemy territory, and,
even then, poor if we get pushed back another 250 miles; and,
in any kind of weather, terrible in case we get pushed back any
further. The list also includes some systems permanently encased
in a hermetically sealed diver's suit, to which are attached,
also permanently, galoshes and an umbrella. This system is useful
in the rain. It's something of a bother in nice weather. (It
is exemplified by the unrefueled and exclusively air-refueled
intercontinental systems which for a fixed budget do poorly in
a uniform way no matter what bases we have available since it
has prepared itself on the assumption always that we shall have
to operate at a maximum range. And it is perhaps best of all
exemplified by the exclusively one-way system.)

These are essentially the two extremes Mr. Hitch
had in mind, his "minimax" and maximum expected value
systems. Observe this kind of "minimaxing" differs
from that treated earlier in this lecture. Earlier we were concerned
with techniques for minimizing the maximum damage likely to be
administered by an intelligent enemy. They illustrate
in contrast with other alternatives the deficiency of both extremes.
As Mr. Hitch stated, both the minimax system (in his sense) and
the maximum expected value system are bad. The latter is totally
unprepared for the worst case and is possibly destroyed by a faint
sign of rain. The former is prepared only for the worst case
and can't exploit the advantages inherent in any of the much more
likely, more favorable circumstances. Moreover, as I have already
suggested, I have not defined the worst case or the system which
would minimize our cost to do the job in the event of this catastrophe.
I have assumed that Maine would not defect, and that we would
have Limestone. But just what other disasters might we consider?
Can we be sure even of Omaha? There is a real problem in defining
the maximum disaster we want to minimize. But we should recognize
in moments of calm that some of the contingencies we are talking
about in this connection--the political defection of Maine among
others--are not very likely and also are not entirely subject
to the enemy's control.

I would distinguish here several sorts of disaster.
One sort, for example, an enemy attack aimed at denying our bases,
is subject to his decision. If our bases are weak, the attack
is both likely to take place and likely to be successful. This
sort of disaster is not just bad luck. We can measure his capabilities
and our susceptibility to attack and introduce the results of
attack as an integral part of our systems analysis. Such disasters
might be called systemic. We have discussed ways of dealing with
this problem.

Another sort of disaster is the kind of thing that
we are ordinarily thinking of when we talk of contingency planning.
It is typified by extremely bad weather which denies us the possibility
of operating from various bases. This is subject neither to our
or his control and is a case of bad luck. An extra-systemic factor.
It must be prepared for. But we must recall that we are countering
nature here, so to speak, and not the enemy. When you are faced
with an intelligent opponent it is sensible to suppose it likely
that he will choose the best of a number of alternatives likely
to be known and available to him for exploiting soft spots. Nature,
however, in spite of some evidence to the contrary presented in
Thurber's short stories, is not malign.

From the standpoint of contingency planning political
disasters lie somewhere in between brute nature and a bombing
attack, and rather closer to brute nature. The consequences of
diplomatic moves are not as subject to systemic prediction as
the result of a bomb exploding on a concrete runway. But like
the weather they must be taken into account. To take them grossly
into account in contingency planning we need not assign exact
numbers to the probability of Canada's defection. We do have
to be able to place some rough limits on the likelihoods involved,
to make some judgment such as 1) it is more likely than not that
in the next ten years or so we will lose at least a few of our
hundred-odd bases; 2) it is not nearly so likely that we will
lose all of them; 3) Texas is politically reliable as a base area.

It is important, however, to be prepared for some
of the less likely contingencies and not just the most probable
one. This is the subject of insurance. There are a large variety
of systems indicated in this list of alternatives in Figure 6
which provide various degrees of insurance in contingencies.
It seems unlikely that in such complex and uncertain circumstances
as the Air Force prepares for that a pure force will be optimal.
In making development choices we are wise to hedge and develop
more than we'll procure. Mr. Hitch made this point and so other
lecturers. This means that we are putting off the procurement
choice until later. This tactic of delaying decisions occurs
not only in development hedging but in choosing any flexible system
at any stage of the development - procurement - operation cycle.
Figure 6 shows several systems which can be operated in a multiplicity
of ways in appropriate contingencies. When we procure
such a system we leave open the choice of which way we'll operate
until the contingency arises. They exploit a third principle
we might call "The Multiple-Use Principle." Preserving
flexibility then means delaying decisions. You may get the impression
from some of the things you hear this week that the lecturers
conceive the task of systems analysis not so much as that of assisting
decision as of teaching the Air Force to resist it. Is Hamlet
then our model of a modern major general? His example has evidenced
that the decision-makers in the end must decide. The point made
about preserving flexibility is best phrased not in terms of postponing
decision, but in terms of not rushing it. Decision implies choosing
one course of action rather than others. It means cutting out
some alternatives. How is the necessity of decision consistent
with the need to develop flexible systems viable under a wide
variety of alternative circumstances? The answer is that a flexible
system is not defined as one which incorporates all weapons alternatives
by simple addition. This is the simplest sort of mixture. And,
since we are constrained by a budget, even if we choose one weapons
system type for each alternative contingency, we are sacrificing
some quantity of weapons of other types merely by introducing
a new type into the mixture. A system which will perform well
in alternative contexts is good precisely insofar as it enables
us to meet one contingency without sacrificing capability excessively
in others. It is good for example if it enables us to preserve
capability in contingencies and yet eliminate some special systems
as redundant. The systems in this list which involve multiple
uses for the same item are of this character.

Figure 6 lists a variety of forces of strategic bombers,
some pure, some involving a mixture of bomber types each of which
is largely convertible and some forces involving various convertible
systems. In making our choice among these forces it is essential
to consider their performance in all of the interesting contingencies
and not just in one. This means we must look not only at the
expected case but also at the insurance contingency. It also
means that it is not enough to look at the insurance contingency
alone even when we are talking of a weapon system which is primarily
thought of as a hedge. Because it may be that there are alternative
hedges. And it is always good to ask whether some of these hedges
also turn out to be useful in the other fairly likely circumstances.
There is an interplay then between our insurance and our other
objectives. Unless we are dead certain that we will lose every
one of our allies, if we have two systems which are equally good
operating from the ZI U.S. but one of which is a great deal better
just in case, for example, at least Canada is still with us, then
clearly this second system is preferable. (Our choice is even
clearer if the two systems compared have performance like the
last two shown in Figure 6.)

Let me recur to another pair of contingencies mentioned
earlier: the case in which we get the first strike in a war against
the Soviets and the case in which this desirable order is reversed.
There are many who think the unsatisfactory order more likely;
there are some who are more optimistic. In any case it is clear
that we are far from being able to be sure. And we saw earlier
that systems that look just fine where we get the first strike
can look very bad indeed when we don't. Designing a system which
does well in both of these contingencies then is of prime importance.
Such a system might, for example, save our cities in case we
get the first strike, and at worst where he strikes first, insure
that his own cities will be devastated. Such a system, illustrated
in Figure 7, is a reliable deterrent and would dominate the two
systems illustrated earlier in Figures 3, 4, and 5. This sort
of dominance is not likely to be stumbled onto. It is more frequently
the work of design.

The work of designing such comprehensive systems
involves ingenious construction both of detailed systems components
and of the force as a whole and its strategy of operation. But
such invention is fruitful even if just spent on smaller systems
which we are in the habit of thinking of as "components."

It may still be asked, is it possible except as an
extraordinary stroke of luck, to invent any system, in the small
or in the large, which dominates its many million alternatives?
Can we find the optimum in the sense of the best possible? I
am inclined to think that this question is beside the point.

The point is to get something better. And here the
difficulties of the problems we are attacking offer a kind of
inverted comfort. The solutions currently accepted for many problems
of importance may be quite inadequate. This would hardly be surprising
in the light of our review of the difficulties brought about by
the swift and continual changes in modern weapon technology.
The implications of such changes are complex, far reaching, not
easily understood and still less easily faced in practice.
The Departments of Defense and National Security
which are the organs for making decisions in this area and carrying
them out have to be big in order to handle the immense detail
of administration of these programs. But big institutions, as
we remarked when we noted the possibility that the enemy might
be using irrational strategies, exhibit considerable inertia.
The same is true for us. Our actual programs may lag. Our strategies
may be inert. But this at any rate offers an opportunity for
the inventive systems designer who is detached sufficiently from
the detail of every-day operation to be able to look hard at the
wider implications of impending technical and political change.

Even if a systems analysis cannot determine an ideal
"best" (and defining "best possible" has difficulties
related to those that trouble the definition of "worst possible"),
it is helpful if it finds and proves some system which is distinctly
better than others that are likely otherwise to be accepted.
And this much systems analysis has already demonstrated that it
can do.

[1] I want to thank J. F. Digby, F. S. Hoffman, and H. J. Kahn for stimulation
in connection with this lecture.

The RAND Corporation is a research organization that develops solutions to public policy challenges to help make communities throughout the world safer and more secure, healthier and more prosperous. RAND is nonprofit, nonpartisan, and committed to the public interest.